Saudi Arabia Country-by-Country Reporting (CbCR) Notification Procedure

Executive summary

This blog is focused on the notification obligation (due within 120 days of year-end) which is distinct from the CbCR filing obligation (the full Country-by-Country Report, due within 12 months of year-end).

As of the date of publishing of this blog, the Saudi CbCR notification framework is best understood as having two practical compliance touchpoints for a Saudi constituent entity that is part of a reportable Multinational Enterprise (“MNE”) group: first, completion of Section 2 of the Transfer Pricing Disclosure Form, which is part of the annual tax or zakat return and captures the UPE and reporting-entity information; second, completion of the Automatic Exchange of Information (“AEOI”) portal “Article 3 Notification” (deriving from Article 3 of the OECD BEPS Action 13 Model Legislation) workflow, which ZATCA’s AEOI user guide describes as an annual prerequisite before CbC filing creation on the portal. The legal trigger for notification remains Article 18(F) and (G) of the Transfer Pricing Bylaws, which require notification within 120 days after the end of the reporting year for MNE groups whose prior-year consolidated revenue exceeds SAR 3.2 billion. On who must notify, the core official rule is that a Constituent Entity of an MNE Group that is a Taxable Person in Saudi Arabia, including a Saudi tax-resident UPE or SPE, must notify ZATCA of the identity and residence of the reporting entity and the country where the CbC report will be filed. ZATCA’s FAQ  also states that every taxpayer who is an MNE group member, including the UPE or SPE, must notify within 120 days, and it separately confirms that a 100% zakat person that is part of a group expected to file a CbC report must also file the notification form that is part of the TP disclosure form.

For the income tax return interaction, ZATCA’s TP Guidelines are explicit that Section 2 of the Disclosure Form is the “Country-by-Country Report Notification Form.” The official guidance says this section requires disclosure of the UPE’s legal name, TIN, jurisdiction and reporting year or financial year-end, and then the reporting entity’s legal name, TIN, filing jurisdiction and reporting year or financial year-end. The user manual portion of the same ZATCA guideline confirms these fields in plainer operational language.

For practice, the safest current position is to complete both the return-based disclosure and the AEOI Article 3 portal notification where the Saudi entity is in scope, because ZATCA’s current AEOI materials operationalize Article 3 notification on the portal and it appears so that the portal filing as an additional live compliance step rather than a substitute for the return disclosure.

Legal framework and scope 

The primary legal basis is the Transfer Pricing Bylaws issued pursuant to Board Resolution No. [6-1-19] dated 25/05/1440H corresponding to 31/01/2019, together with ZATCA’s TP Guidelines and FAQ guidance. Article 18 is the operative CbCR article. Article 18(F) requires a Saudi constituent entity that is a taxable person, including a Saudi tax-resident UPE or SPE, to notify ZATCA of the identity and residence of the reporting entity and the country of CbC filing, and Article 18(G) applies the requirement where the MNE group’s prior-year consolidated revenue exceeds SAR 3.2 billion. 

In scope, therefore, are Saudi entities that fall within the Constituent Entity concept and belong to an MNE group above the threshold. The official bylaw text uses the MNE group’s preceding year consolidated financial statements as the threshold test year. ZATCA’s FAQ archive repeats this threshold and states that, in general, parties subject to transfer pricing and related to MNE groups with consolidated revenue over SAR 3.2 billion are required to file and submit the report, where Article 18 requires them to do so. 

On UPE, SPE and local constituent entities, ZATCA’s FAQ states that each UPE or SPE of an MNE group should file the CbC report to ZATCA where Article 18(A) applies, and that a non-UPE constituent entity may file where Article 18(B) conditions are met. Article 18(B) creates the Saudi local filing / secondary filing rule where the Saudi entity , being a taxpayer, is not the UPE or SPE and one of the following exists: the parent jurisdiction does not obligate CbCR filing, there is no enforceable Qualifying Competent Authority Agreement, or the parent jurisdiction systemically fails to exchange. 

Where there is more than one Saudi constituent entity and a local filing trigger exists, Article 18(C) allows the MNE group to designate one Saudi constituent entity to file the CbC report and notify ZATCA that the filing is intended to satisfy the local filing requirement for all Saudi constituent entities in the group. This is important because it means the Saudi notification analysis should always include whether there are multiple Saudi entities and whether one entity has been formally designated.  

For zakat payers, the official ZATCA FAQ already states that a 100% zakat person that is part of a group expected to file a CbC report must file the notification form in the TP disclosure form. Saudi TP rules were amended to bring zakat payers within scope more broadly, with implementation from 1 January 2024 and different documentation thresholds for zakat payers.  

Filing mechanics and tax return interaction 

ZATCA’s TP Guidelines state that the Transfer Pricing Forms consist of the Disclosure Form of Controlled Transactions and the CbCR Notification, and that these forms are part of the tax or zakat return. The same guideline says the Disclosure Form must generally be submitted within 120 days after the last day of the fiscal year, which usually coincides with the return filing deadline, but the 120-day rule still applies even where the tax return filing deadline has an exception, including the example of partnerships. ZATCA’s FAQ likewise states that the TP Disclosure Form must be submitted along with the income tax return within 120 days from fiscal year-end.  

For the specific tax return section, ZATCA’s TP Guidelines identify “Section 2: Country-by-Country Report Notification Form.” The official description says the taxpayer must first indicate whether it is part of an MNE group required to file a CbC report, and the answer should be “Yes” where the threshold is met. The guidelines then state that in subsections A-D the taxpayer must enter the UPE details, and in subsections E-H the reporting-entity details.  

The ZATCA user-manual appendix of the TP Guidelines says that after selecting “Yes” in Section 2, the taxpayer must fill in the legal name of the Ultimate Parent Entity, the TIN / identification number for the UPE, the tax jurisdiction of the UPE, and the financial year-end of the UPE. It then says the taxpayer must fill in the legal name of the filing entity, the TIN / identification number for the filing entity, the jurisdiction of filing the CbC report, and the financial year-end of the filing entity, and then click Review once the required fields have been completed. 

The current external portal channel sits alongside that return disclosure. ZATCA’s current AEOI platform page presents CbCR as one of the reporting streams on the official AEOI platform and provides the official CbCR contact channel. ZATCA’s AEOI External User Guide then states that, after enrolment is approved, all reporting entities having the CBC filing submission role must complete the Article 3 Notification before filing creation, that this is done once a year, and that it is a prerequisite for CBC filing submission. The guide routes the user through System Administration to the Article 3 notification card.  

The same ZATCA AEOI guide says the Article 3 notification form has four sections: Notifying Entity Information, Registered Address of Notifying Entity, Information of the Multinational Enterprise/Entity of the Notifying Entity, and Constituent Entity Information. The guide also requires the user to accept the declaration and submit. The screenshot in the official ZATCA AEOI guide indicates that the notification workflow captures, within a single submission process: 

1. the notifying entity’s identity details and address; 
2. the classification of the notifying entity as a UPE, SPE, or other Constituent Entity; and 
3. the details of the reporting/filing entity responsible for submitting the CbC report. 

The AEOI portal also has an enrolment workflow. The ZATCA user guide says the enrolment form is used to create the reporting-entity profile in the AEOI system, that the user must fill the reporting-entity details and then submit for ZATCA review, and that during account creation the user fills reporting-entity information, primary-user information and backup-user information and uploads a valid ID and authorization letter in JPEG, PNG or PDF.

Practical interaction:  

• The return-based Section 2 disclosure satisfies the annual TP return obligation, while the AEOI Article 3 portal notification is the operational notification step used on the exchange-reporting platform.  
• Saudi constituent entities are required to file an additional CbC notification through the AEOI portal in addition to the notification filed along with the TP disclosure form.  

Other compliance obligations beyond the notification 

CbCR notification sits inside a broader Saudi TP compliance package. ZATCA’s bylaws and guidelines require the filing of the Disclosure Form of Controlled Transactions, and the TP Guidelines explain that the disclosure form is used for risk assessment and may be followed by requests for supporting information. ZATCA’s FAQ confirms that the disclosure form is electronic and part of the tax return.  

For Master File and Local File, Article 15 requires sufficient documentation to confirm that controlled transactions are arm’s length, to keep it readily accessible and available for review, and to provide it when requested within a period specified by ZATCA that cannot be less than 30 days.  Articles 16 and 17 outline the information and documentation required to be maintained in the master file and local file respectively.  Article 19 exempts, amongst others, natural persons and small enterprises from maintaining the documentation described in Articles 16 and 17, but ZATCA may still direct preparation in specified cases. ZATCA’s FAQ further states that where the aggregate arm’s-length value of controlled transactions is less than SAR 6 million in a 12-month period, the taxpayer may answer “Not Applicable” to the TP documentation question in the disclosure form, and the same FAQ says such taxpayers are not required to maintain the Master File and Local File for that year unless otherwise expressly required.  

For the auditor certificate / affidavit, the TP Guidelines state that where Sections 1 and 2 of the TP forms are completed, the taxpayer must attach a Chartered Accountant Certificate from a licensed auditor in Saudi Arabia declaring that the MNE group’s TP policy is consistently applied in relation to the Saudi taxpayer. ZATCA’s FAQ similarly says taxpayers must submit an affidavit from a public accountant authorized to work in Saudi Arabia.  

For local filing / secondary filing, Article 18(B) is material even if the assignment is currently “notification only,” because the Saudi notification must correctly identify the filing entity and jurisdiction. If the foreign parent jurisdiction does not impose CbCR, lacks an enforceable QCAA with Saudi Arabia, or has a systemic failure, the Saudi entity may itself become the local filer. Where multiple Saudi entities exist, one can be designated to file for all of them.  

For books and records, the official TP rules require the taxpayer to keep sufficient documentation readily accessible and available for review.  

For portal administration and changes, the ZATCA AEOI user guide shows three relevant administrative functions: Change Reporting Entity Info, Primary User Change, and Reporting Entity Obligations, each submitted through the system administration section for ZATCA review.  

For penalties, the position is more nuanced than many practitioners assume. The TP Bylaws and the ZATCA TP sources do not set out a bespoke, self-contained CbCR-notification penalty schedule but ZATCA FAQs  indicate that penalties and fines under the Income Tax Law apply to income tax matters; the official Income Tax Law also has the following Articles which could be relevant: 

• Article 76: Fines for failure to file the declaration 
• Article 77: Delay and Fraud Fines 

Procedural checklist and timeline 

For a typical Saudi calendar-year entity, the cleanest compliance sequence is:

1. Determine threshold and filing status immediately after year-end, prepare the return-based TP disclosure and Section 2 notification. 
2. Ensure AEOI enrolment and portal access are active. 
3. Submit the AEOI Article 3 notification by day 120 and preserve acknowledgement evidence for both channels.  
4. The official ZATCA materials support the 120-day notification deadline, the return-based disclosure, and the Article 3 portal workflow. 

Interpretive issues, pitfalls, and mitigation 

The biggest practical issue is that Saudi materials are not all written from a single channel perspective. The TP Guidelines focus on the tax-return disclosure form, while the current AEOI materials focus on the portal process.  For a practitioner, the conservative filing position is to complete both and maintain proof for both. 

Common pitfalls arise from misidentifying the reporting entity, using inconsistent UPE names or TINs across the return and portal, assuming the foreign parent’s filing automatically eliminates Saudi notification, and treating the portal as optional because Section 2 was completed in the return.  

The most effective mitigations are procedural rather than technical:  

1. maintain a single group CbCR master-data sheet for UPE, SPE, reporting entity and filing jurisdiction; 
2. perform a two-channel reconciliation between the return and the portal just before submission; ensure the AEOI enrolment is active well before day 120; and  
3. preserve screenshots or PDF acknowledgements from every submission step.  

Summary 

Saudi Arabia’s CbCR notification framework requires qualifying Saudi constituent entities to discharge two parallel obligations within 120 days of year-end: completion of Section 2 of the TP Disclosure Form (filed as part of the tax or zakat return) and submission of the Article 3 Notification on the ZATCA AEOI portal.